Sign in
Deutsch English Español Polski
Medium

HTTP Request Smuggling in Apache Tomcat

  • Disclosed: 13.08.2021
  • Updated: 11.10.2026 12:21

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.apache.tomcat:tomcat >= 10.0.0-M1, < 10.0.7, >= 9.0.0-M1, < 9.0.48, >= 8.5.0, < 8.5.68 10.0.7, 9.0.48, 8.5.68

References

CVSS score 5.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE)
CWE-444
Platform
Java / Kotlin (Maven)
Package
org.apache.tomcat:tomcat
Disclosed
13.08.2021
Updated
11.10.2026 12:21

Sources and licenses

OSV / GitHub Advisory Database - GHSA-4vww-mc66-62m6 - CC BY 4.0

Vulnerability history: org.apache.tomcat:tomcat

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (162) in the archive
Total entries
162
First → latest
12.2018 08.2026
Without a fix
20
Exploited in attacks
1

Severity breakdown

  • Critical 8
  • High 40
  • Medium 102
  • Low 12

Disclosures per year

Severity:
  1. Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
    Critical · 9.8 CVE-2026-65905 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0.M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.30, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  2. Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
    Critical · 9.1 CVE-2026-65182 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0-M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.0, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  3. Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
    Critical · 9.1 CVE-2026-68525 >= 11.0.0-M1, < 11.0.25, >= 10.1.0-M1, < 10.1.58, >= 9.0.0-M1, < 9.0.121, >= 8.5.0, <= 8.5.100, >= 7.0.0, <= 7.0.109 11.0.25, 10.1.58, 9.0.121
  4. Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
    High · 7.5 CVE-2026-41284 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  5. Apache Tomcat - Digest authenticator will authenticate any unknown user
    Critical · 9.8 CVE-2026-43512 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  6. Apache Tomcat: LockOutRealm treats user names as case-sensitive
    High · 7.5 CVE-2026-43513 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  7. Apache Tomcat - Security constraints not correctly applied
    Critical · 9.1 CVE-2026-43515 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  8. Apache Tomcat - WebSocket authentication header exposure
    High · 7.3 CVE-2026-42498 < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  9. Apache Tomcat - HTTP/2 request headers not validated
    Critical · 9.8 CVE-2026-41293 >= 8.5.0, < 9.0.118, >= 10.1.0-M1, < 10.1.55, >= 11.0.0-M1, < 11.0.22 9.0.118, 10.1.55, 11.0.22
  10. Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File
    High · 7.5 CVE-2026-34487 >= 9.0.13, < 9.0.117, >= 10.1.0-M1, < 10.1.54, >= 11.0.0-M1, < 11.0.21 9.0.117, 10.1.54, 11.0.21
  11. Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
    High · 7.5 CVE-2026-34483 >= 9.0.40, < 9.0.116, >= 10.1.0-M1, < 10.1.54, >= 11.0.0-M1, < 11.0.21 9.0.116, 10.1.54, 11.0.21
  12. Apache Tomcat Missing Encryption of Sensitive Data vulnerability
    High · 7.5 Exploited in attacks CVE-2026-34486 >= 11.0.20, < 11.0.21, >= 10.1.53, < 10.1.54, >= 9.0.116, < 9.0.117 11.0.21, 10.1.54, 9.0.117
  13. Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor
    High · 7.5 CVE-2026-29146 >= 9.0.13, < 9.0.116, >= 10.1.50, < 10.1.53, >= 11.0.0-M1, < 11.0.20, >= 8.5.38, <= 8.5.100, >= 7.0.100, <= 7.0.109 9.0.116, 10.1.53, 11.0.20
  14. Apache Tomcat: CLIENT_CERT authentication does not fail as expected
    Critical · 9.1 CVE-2026-29145 >= 9.0.83, < 9.0.116, >= 10.1.0-M7, < 10.1.53, >= 11.0.0-M1, < 11.0.20 9.0.116, 10.1.53, 11.0.20
  15. Apache Tomcat: Configured cipher preference order not preserved
    High · 7.5 CVE-2026-29129 >= 9.0.114, < 9.0.116, >= 10.1.51, < 10.1.53, >= 11.0.16, < 11.0.20 9.0.116, 10.1.53, 11.0.20
  16. Apache Tomcat Vulnerable to Relative Path Traversal
    High · 7.5 CVE-2025-55752 >= 11.0.0-M1, < 11.0.11, >= 10.1.0-M1, < 10.1.45, >= 9.0.0-M11, < 9.0.109, >= 8.5.6, <= 8.5.100 11.0.11, 10.1.45, 9.0.109
  17. Deserialization of Untrusted Data in Apache Tomcat
    High CVE-2013-2185 < 7.0.39 7.0.39
  18. Improper Neutralization of Input During Web Page Generation in Apache Tomcat
    High · 8.1 CVE-2015-5346 >= 9.0.0.M1, < 9.0.0.M2, >= 8.0.0.RC1, < 8.0.31, >= 7.0.0, < 7.0.66 9.0.0.M2, 8.0.31, 7.0.66
  19. Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token
    High · 8.8 CVE-2015-5351 < 7.0.68, >= 8.0.0, < 8.0.31, >= 9.0.0.M0, < 9.0.0.M2 7.0.68, 8.0.31, 9.0.0.M2
  20. Apache Tomcat does not enforce the maxHttpHeaderSize limit
    High · 7.5 CVE-2011-0534 >= 6.0.0, < 6.0.32, >= 7.0.0, < 7.0.8 6.0.32, 7.0.8
  21. Apache Tomcat Allows Remote Attackers to Spoof AJP Requests
    High CVE-2011-3190 >= 7.0.0, < 7.0.21, >= 6.0.0, < 6.0.34, >= 5.0.0, < 5.5.34 7.0.21, 6.0.34, 5.5.34
  22. Uncontrolled Resource Consumption in Apache Tomcat
    High CVE-2014-0230 >= 6.0.0, < 6.0.44, >= 7.0.0, < 7.0.55, >= 8.0.0, < 8.0.9 6.0.44, 7.0.55, 8.0.9
  23. Improper Access Control in Apache Tomcat
    High · 8.8 CVE-2016-0714 >= 9.0.0.M1, < 9.0.0.M2, >= 8.0.0.RC1, < 8.0.32, >= 7.0.0, < 7.0.70, >= 6.0.0, < 6.0.46 9.0.0.M2, 8.0.32, 7.0.70, 6.0.46
  24. Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
    High · 7.5 CVE-2016-6817 >= 9.0.0.M1, < 9.0.0.M12, >= 8.5.0, < 8.5.8 9.0.0.M12, 8.5.8
  25. Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
    High · 7.5 CVE-2017-5647 >= 9.0.0.M1, < 9.0.0.M19, >= 8.5.0, < 8.5.13, >= 8.0.0, < 8.0.43, >= 7.0.0, < 7.0.77, >= 6.0.0, < 6.0.53 9.0.0.M19, 8.5.13, 8.0.43, 7.0.77, 6.0.53
  26. Apache Tomcat allows remote attackers to read data that was intended to be associated with a different request
    High · 7.5 CVE-2016-8747 >= 8.5.7, < 8.5.10, >= 9.0.0.M11, < 9.0.0.M16 8.5.10, 9.0.0.M16
  27. Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
    High · 7.5 CVE-2017-7675 >= 9.0.0.M1, < 9.0.0.M22, >= 8.5.0, < 8.5.16 9.0.0.M22, 8.5.16
  28. Improper socket reuse in Apache Tomcat
    High · 8.6 CVE-2022-25762 >= 8.5.0, < 8.5.75, >= 9.0.0M1, < 9.0.20 8.5.75, 9.0.20
  29. Improper Handling of Exceptional Conditions in Apache Tomcat
    High · 7.5 CVE-2017-5664 >= 9.0.0.M1, < 9.0.0.M21, >= 8.5.0, < 8.5.15, >= 8.0.0, < 8.0.44, >= 7.0.0, < 7.0.78 9.0.0.M21, 8.5.15, 8.0.44, 7.0.78
  30. Improper Resource Shutdown or Release in Apache Tomcat
    High · 7.5 CVE-2017-5650 >= 9.0.0.M1, < 9.0.0.M19, >= 8.5.0, < 8.5.13 9.0.0.M19, 8.5.13
  31. Apache Tomcat vulnerable to SecurityManager bypass
    High · 7.5 CVE-2016-6796 >= 9.0.0.M1, < 9.0.0.M10, >= 8.5.0, < 8.5.5, >= 8.0.0.RC1, < 8.0.37, >= 7.0.0, < 7.0.71, >= 6.0.0, < 6.0.46 9.0.0.M10, 8.5.5, 8.0.37, 7.0.71, 6.0.46
  32. Incorrect Authorization in Apache Tomcat
    High · 7.5 CVE-2016-6797 >= 9.0.0.M1, < 9.0.0.M10, >= 8.5.0, < 8.5.5, >= 8.0.0, < 8.0.37, >= 7.0.0, < 7.0.72 9.0.0.M10, 8.5.5, 8.0.37, 7.0.72
  33. Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption
    High · 7.5 CVE-2022-29885 >= 10.1.0-M1, < 10.1.0-M15, >= 10.0.0-M1, < 10.0.21, >= 9.0.13, < 9.0.63, >= 8.5.38, < 8.5.79 10.1.0-M15, 10.0.21, 9.0.63, 8.5.79
  34. Apache Tomcat affected by vulnerability in TLS and SSL protocol
    Critical · 9.8 CVE-2009-3555 >= 7.0.0, < 7.0.10, >= 6.0.0, < 6.0.32, >= 5.0.0, < 5.5.33 7.0.10, 6.0.32, 5.5.33
  35. Apache Tomcat Buffer Over-Read
    High CVE-2006-7197 <= 5.5.15 no fix
  36. Apache Tomcat allows remote attackers to read JSP source files
    High CVE-2005-4836 >= 4.1.15, <= 4.1.40 no fix
  37. Apache Tomcat Vulnerable to Denial of Service (DoS) via Simultaneous Requests
    High CVE-2005-3510 >= 5.5.0, < 5.5.12 5.5.12
  38. Apache Tomcat DoS via Malicious Get Request
    High CVE-2002-2272 >= 4.0.0, <= 4.1.12 no fix
  39. Apache Tomcat Source Code Disclosure
    High CVE-2002-1394 < 4.0.6 4.0.6
  40. Apache Tomcat may be started without proper security settings
    High CVE-2002-0493 < 4.0b7 4.0b7
  41. Uncontrolled Resource Consumption in Apache Tomcat
    High · 7.5 CVE-2020-11996 >= 10.0.0-M1, < 10.0.0-M5, >= 9.0.0.M1, < 9.0.35, >= 8.5.0, < 8.5.55 10.0.0-M5, 9.0.35, 8.5.55
  42. Infinite Loop in Apache Tomcat
    High · 7.5 CVE-2020-13935 >= 10.0.0-M1, < 10.0.0-M7, >= 9.0.0.M1, < 9.0.37, >= 8.5.0, < 8.5.57, >= 7.0.27, < 7.0.105 10.0.0-M7, 9.0.37, 8.5.57, 7.0.105
  43. Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
    High · 7.5 CVE-2020-13934 >= 10.0.0-M1, < 10.0.0-M6, >= 9.0.0.M5, < 9.0.36, >= 8.5.1, < 8.5.56 10.0.0-M6, 9.0.36, 8.5.56
  44. Race condition in Apache Tomcat
    High · 7.0 CVE-2022-23181 >= 10.0.0, < 10.0.16, >= 9.0.0, < 9.0.58, < 8.5.75 10.0.16, 9.0.58, 8.5.75
  45. Missing Release of Resource after Effective Lifetime in Apache Tomcat
    High · 7.5 CVE-2021-42340 >= 10.1.0-M1, < 10.1.0-M6, >= 10.0.0-M1, < 10.0.12, >= 9.0.40, < 9.0.54, >= 8.5.60, < 8.5.72 10.1.0-M6, 10.0.12, 9.0.54, 8.5.72
  46. Infinite loop in Tomcat due to parsing error
    High · 7.5 CVE-2021-41079 >= 10.0.0, < 10.0.4, >= 9.0.0, < 9.0.44, >= 8.5.0, < 8.5.64 10.0.4, 9.0.44, 8.5.64
  47. HTTP Request Smuggling in Apache Tomcat this entry
    Medium · 5.3 CVE-2021-33037 >= 10.0.0-M1, < 10.0.7, >= 9.0.0-M1, < 9.0.48, >= 8.5.0, < 8.5.68 10.0.7, 9.0.48, 8.5.68
  48. Improper Handling of Exceptional Conditions in Apache Tomcat
    High · 7.5 CVE-2021-30639 >= 10.0.3, < 10.0.5, >= 9.0.0, < 9.0.45, < 8.5.65 10.0.5, 9.0.45, 8.5.65
  49. Commons FileUpload Denial of service vulnerability
    High CVE-2014-0050 >= 8.0.0-RC1, < 8.0.3, >= 7.0.0, < 7.0.52 8.0.3, 7.0.52

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.